IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

CB Response: How to enable event collection on an eventless master

CB Response: How to enable event collection on an eventless master

Environment

  • CB Response Server: 6.x
  • Clustered Environment 
  • Eventless Master Server

Objective

Convert an eventless master to start ingesting events

Resolution

  1. Open an SSH session with the master server
  2. Stop services
    • sudo /usr/share/cb/cbcluster stop
  3. Set the master to collect events
    • sudo /usr/share/cb/cbcluster change-node -E True
  4. Start services
    • sudo /usr/share/cb/cbcluster start

Additional Notes

  • Ensure the master server has sufficient resources to begin collecting and storing data.
  • Event collection on the master can be disabled by the steps above, but using the value False instead of True in step 3.
    • sudo /usr/share/cb/cbcluster change-node -E False

 

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
627
Contributors